Actions on the intercepted requests

Once we have an intercepted request, we can send it to Repeater (Ctrl + R) to manipulate it one by one; we can send it to Intruder (Ctrl + I) to simulate an automated attack; we can send it for more spidering, an active scan or even to a Sequencer, Decoder, or Comparer (covered in the next chapter):

The question to ask is what should decide whether we should use Repeater or Intruder?. The short answer is, it is up to you. I personally use Repeater to figure out whether there is a flaw worth using Intruder or not. An active scan is always the last resort for the sake of completeness. This might change based on time and scope as well.

Repeater is like REPL for application security testing. Just like Read-Eval-Print-Loop is an interactive environment to try out any programming language, it allows a tester to send requests and get instant feedback with the responses.

Intruder is like an iterator. We give it a range of values and unleash it on the application...